@YuSheng You are proabably missing allowproxy property-
allowProxy: If a client library is located under /apps, this property allows acces to it via proxy servlet.
In order for the client libraries under /apps to be accessible, a proxy servelt is used. The ACLs are still enforced on the client li...